Skip to content

[stable32] fix: avoid double app password check #1136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ChristophWurst merged 1 commit into from
Aug 31, 2026
Merged

[stable32] fix: avoid double app password check #1136

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 0 additions & 35 deletions lib/Service/LoginClassifier.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,11 +20,6 @@
use OCP\IRequest;
use Psr\Log\LoggerInterface;
use Throwable;
use function base64_decode;
use function explode;
use function preg_match;
use function strlen;
use function substr;

class LoginClassifier {

Expand All @@ -38,37 +33,7 @@ public function __construct(
) {
}

/**
* @todo find a more reliable way of checking this
*/
private function isAuthenticatedWithAppPassword(IRequest $request): bool {
$authHeader = $request->getHeader('Authorization');
if (empty($authHeader)) {
return false;
}
if (substr($authHeader, 0, strlen('Basic ')) !== 'Basic ') {
return false;
}
$pwd = explode(
':',
base64_decode(substr($authHeader, strlen('Basic ')))
);
if (!isset($pwd[1])) {
return false;
}

return preg_match(
"/^([0-9A-Za-z]{5})-([0-9A-Za-z]{5})-([0-9A-Za-z]{5})-([0-9A-Za-z]{5})-([0-9A-Za-z]{5})$/",
$pwd[1]
) === 1;
}

public function process(string $uid, string $ip) {
if ($this->isAuthenticatedWithAppPassword($this->request)) {
// We don't care about those logins
$this->logger->debug("App password detected. No address classification is performed");
return;
}
try {
$strategy = AddressClassifier::isIpV4($ip) ? new Ipv4Strategy() : new IpV6Strategy();
if ($this->estimator->predict($uid, $ip, $strategy)) {
Expand Down
19 changes: 19 additions & 0 deletions tests/Unit/Service/LoginClassifierTest.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,4 +166,23 @@ public function testProcessNoPeakReached(): void {

$this->classifier->process('user', '1.2.3.4');
}

public function testProcessClassifiesRealPasswordShapedLikeAppPassword(): void {
// A genuine account password that happens to match the app-password display format.
$realPassword = 'abcde-fghij-klmno-pqrst-uvwxy';
$this->request->method('getHeader')
->with('Authorization')
->willReturn('Basic ' . base64_encode('user:' . $realPassword));
$this->timeFactory->method('getTime')->willReturn(1000000);
$this->estimatorService->expects(self::once())
->method('predict')
->with('user', '1.2.3.4', self::equalTo(new Ipv4Strategy()))
->willReturn(false);
$this->mapper->method('findRelated')->willReturn([]);
$this->mapper->method('findRecentByUid')->willReturn([]);
$this->dispatcher->expects(self::once())
->method('dispatchTyped');

$this->classifier->process('user', '1.2.3.4');
}
}
Loading